hmmm... charging him per hour or per project is your decision... but tell your contract partner what the price will be in effect.
the thing i do with 'risky' contract partners:
i ask for half of the money beforehand and, to be fair, i do something first, e.g. the planning on how the program will work or a (small) part of the whole program. then i finish the job and ask for the rest of the money.
then, if it's really risky and you want to be secure, either try to make a 'require' function which includes some important function the program needs and is not on your contract partner's server - or you make a hidden self-destroy function to which only you know the password and which deletes everything on your contract partner's server 😉